Direct upload, nothing in the middle
Your browser uploads straight to private object storage using a short-lived, single-object permission. The application never handles your image bytes, which is why a two-thousand-photo gallery does not time out on a server.